Binance hacker circumvented $2.3B in frozen stablecoins by depositing stolen USDT into Aave as collateral to borrow unfrozen ETH, exploiting the protocol's inability to freeze non-stablecoin assets.
Security & Exploits ·
Following a Binance breach, Tether and Circle moved to freeze approximately $2.3 billion in stolen stablecoins—$1.5 billion in USDT and $800 million in USDC. The rapid freeze was widely expected to render the attacker's funds inaccessible, but the hacker had anticipated this response and exploited a structural weakness in DeFi protocols.
Rather than retain the frozen stablecoins, the attacker deposited the stolen USDT into Aave as collateral and borrowed ETH against it. While Tether and Circle retain the ability to freeze their own stablecoin assets, they cannot block transfers of other tokens like ETH once they have left their platforms. This meant the borrowed ether remained accessible to the attacker despite the stablecoin freeze, while Aave was left holding frozen collateral.
The episode exposes a gap in cross-protocol coordination: centralized freezing mechanisms are limited to the issuing platform's own assets, leaving borrowed non-stablecoin funds vulnerable to removal even when their collateral is locked. Whether the attacker faces recovery or repayment obligations remains unclear, as does the full scope of Aave's exposure to the frozen collateral now backing an unsecured loan.